hxxp://faf | Triage™

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 23:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://faf
Sample260910-3v64zahr21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1752	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335578765688354"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{893879FF-E0CC-4323-A7CE-896E232E6649}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5504	msedge.exe
5504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
2284	firefox.exe
2284	firefox.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2284	firefox.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 2984	5100	msedge.exe	85
PID 5100 wrote to memory of 1752	5100	msedge.exe	86
PID 5100 wrote to memory of 2960	5100	msedge.exe	87
PID 5100 wrote to memory of 2960	5100	msedge.exe	87
PID 5100 wrote to memory of 2960	5100	msedge.exe	87
PID 5100 wrote to memory of 4828	5100	msedge.exe	88
PID 5100 wrote to memory of 4828	5100	msedge.exe	88
PID 5100 wrote to memory of 4728	5100	msedge.exe	90
PID 5100 wrote to memory of 3368	5100	msedge.exe	91
PID 5100 wrote to memory of 4728	5100	msedge.exe	90
PID 5100 wrote to memory of 4728	5100	msedge.exe	90
PID 5100 wrote to memory of 3368	5100	msedge.exe	91
PID 5100 wrote to memory of 3368	5100	msedge.exe	91
PID 5100 wrote to memory of 336	5100	msedge.exe	92
PID 5100 wrote to memory of 336	5100	msedge.exe	92
PID 5100 wrote to memory of 336	5100	msedge.exe	92
PID 5100 wrote to memory of 3508	5100	msedge.exe	93
PID 5100 wrote to memory of 3508	5100	msedge.exe	93
PID 5100 wrote to memory of 3508	5100	msedge.exe	93
PID 5100 wrote to memory of 2192	5100	msedge.exe	97
PID 5100 wrote to memory of 2192	5100	msedge.exe	97
PID 5100 wrote to memory of 2660	5100	msedge.exe	98
PID 5100 wrote to memory of 2660	5100	msedge.exe	98
PID 5100 wrote to memory of 3924	5100	msedge.exe	99
PID 5100 wrote to memory of 3924	5100	msedge.exe	99
PID 5100 wrote to memory of 3924	5100	msedge.exe	99
PID 5100 wrote to memory of 2196	5100	msedge.exe	101
PID 5100 wrote to memory of 1616	5100	msedge.exe	102
PID 5100 wrote to memory of 1616	5100	msedge.exe	102
PID 5100 wrote to memory of 1616	5100	msedge.exe	102
PID 5100 wrote to memory of 536	5100	msedge.exe	107
PID 5100 wrote to memory of 536	5100	msedge.exe	107
PID 5100 wrote to memory of 536	5100	msedge.exe	107
PID 5100 wrote to memory of 3924	5100	msedge.exe	119
PID 5100 wrote to memory of 5096	5100	msedge.exe	120
PID 5100 wrote to memory of 2540	5100	msedge.exe	121
PID 220 wrote to memory of 2284	220	firefox.exe	124
PID 220 wrote to memory of 2284	220	firefox.exe	124
PID 2284 wrote to memory of 3320	2284	firefox.exe	125
PID 2284 wrote to memory of 3320	2284	firefox.exe	125
PID 2284 wrote to memory of 3320	2284	firefox.exe	125
PID 2284 wrote to memory of 2892	2284	firefox.exe	126
PID 2284 wrote to memory of 2892	2284	firefox.exe	126
PID 2284 wrote to memory of 2892	2284	firefox.exe	126
PID 2284 wrote to memory of 2892	2284	firefox.exe	126
PID 5100 wrote to memory of 5828	5100	msedge.exe	127
PID 5100 wrote to memory of 5828	5100	msedge.exe	127
PID 5100 wrote to memory of 6104	5100	msedge.exe	129
PID 5100 wrote to memory of 6104	5100	msedge.exe	129
PID 5100 wrote to memory of 5504	5100	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://faf
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x260,0x7ffb8646c188,0x7ffb8646c194,0x7ffb8646c1a0
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,11304135473479739677,17081374475281152774,524288 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,9319054305586379013,9742165540148947218,262144 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,8309150563578276293,8355961144916453121,524288 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,4890955402512141702,8680947282400700011,2097152 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,9978788906386394475,6764497295785460934,2097152 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,15904152011760618768,15573496574648561354,2097152 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,10521817222504701596,9937262369480646318,2097152 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,2146106046108949080,18335334635220101775,524288 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,10424209421876443033,1004479158444838680,524288 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5504,i,11278721466371277180,18007340469316041796,2097152 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,14896580294194629710,15353346493172647840,524288 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,14896580294194629710,15353346493172647840,524288 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3880,i,1309081029837356022,10760003166800633942,2097152 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6360,i,12704490051730693824,10522562014501219827,2097152 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,16681344848845619889,460953372676575988,524288 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,13687748644779748003,9226725294648325336,524288 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,9924570065732854473,17303995513756207741,524288 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,10826890153790406687,562044421924191607,524288 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,12232248608155663428,856538913253676522,524288 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,5449248861243685427,12600439302894969356,262144 --field-trial-handle=2340,i,5941929035959067273,14720544402645849373,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2464

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1436

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2080 -initialChannelId {ef9bb3f5-12c2-415c-93f4-44f6af1a700b} -parentPid 2284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2284" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2512 -prefsLen 27135 -prefMapHandle 2516 -prefMapSize 270279 -ipcHandle 2524 -initialChannelId {dc3a231f-3e0b-4d04-9a3b-37a7218324b0} -parentPid 2284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 21916bd4ff5d8352c56dee6a81be174493beaf79015a1cd73bf87d3641937777
MD5 3c64d7d928426c0990a1d275b3d712c7
SHA1 ee73164dabf406188415054f8478e3e0a735499b
SHA512 8362ae4d667e7f8e36014d289a1d224e820d3aa7afde9c1a3cbb3f608d045c8478266170b54db3988b0ce2ef11cec1d52e8dc8464fb773f77e3f48575752d729
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7q:fwUQC5VwBIiElEd2K57P7q
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 234bb2c3808aa65858b24d8fe4f0dae1ec1caabcc2bca08c0dce312a02b6e066
MD5 d8c9aa2a25fcc969b29c84a9f8f5ec35
SHA1 6d6aa7e9653b10393646a09670fa07f4e47f0eea
SHA512 28f92b4a890063e3f9da0f7ed9dccfb3e8f70804d875e99e612d3f424c6e8e7476704579ac5761702ff3a66df54cfe80a9255e293cec4a44aa5e21e28f435816
TLSH
T1BF71F80503954991EFAED6F3FEE91005F663D6892D0BFD65228068FC1C16760A92ECFB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585c06.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585c06.TMP
Size 3KB
SHA256 aea4f9144e0c299bbf69568d26f6de12819446fc2e2104d3f7ba489eb6b5c0d2
MD5 1f12203f5cabc5bf20002275f17dc3d8
SHA1 df1b6e49724bd84eb27bcafad2e66de16f4d04a9
SHA512 2c2d6aef1672d64654059ded470f828ff9a55a16a69c7151d88861d33ac62f4cc7f6d6ddb23bcd596e39813b929cf64fb700058e8804673b0e0713841cbca9ee
TLSH
T12A71E70503954991EFAED2F3FEE91105F663D6892D0BFD65228068FC1C16760A92ECFB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ad8c03282674c5ad0e6145bb65279994668fa1d78f10d3ce6b468fa07fc10250
MD5 5a8fc36fc91fdaca5bdfa4e31c2c2231
SHA1 d3b9d00aa872702cc9e5a1c2c011c4a717467692
SHA512 1264511ba93f2007827c7ba653d6e2181714d55b46a3aaf3e3571fcf7f2e0509d46b53a06396372b8e331972b24f551563a9cb824f76c222d6c43c2ec4e2a40b
TLSH
T19E216DF3C7D5866EC91116F05A24AE2BCE1D0A16422C7D1AC5D4EF6BD3E3075D1029AF
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 3d4b8257300f9cefe1bcfb126522331f3a0a93a30b4e3feb256e5ffe0b6b078f
MD5 f21606c24a7a1cd69fad1c33fde6e489
SHA1 2b7c6329304b629db3c33f005dd8ae277486a561
SHA512 92fbde48686d33b4085ee71f5e5e3e5e6b16b1afcc7f721a2f1206c40bb77a346ca23a91c46f13c72d48fae584f92c1e0db9d3c5147a24a8335808806bf5978e
TLSH
T17DD0237322553575A56C3DD55556BC8FD32A10A40447DDD960D055DD453147C1A17140
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5859a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5859a4.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7d8e5dbd51d6ad1e1518e3c33d3b52274d5ae086e407bc8be75cc1cedc5771dc
MD5 1e5da01ecafab19c4363750cce8808f6
SHA1 12b588f6080e360a9381781f34e914bcc6094eaa
SHA512 0bdee7ca2003298303da65020dd0ee368cc2fdc114131d62ae6764916269afe85913e115be831c801251cf54c5abe76e40fa9848cefecee10ac1067dd707eeb6
SSDEEP 192:sxZ1gXRWyM/jK1Ml8MW5/fEs+YIdpnxSHW6+WNGYLzKZXIgrJ:sxZ1gXUu5/fEs+pEHbGD9
TLSH
T17D42F911AA346977CCDBD20DB955BF53D6F94473A2500E489AFCDA1C04E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 72b33314d423551e2c97d92e2821eac1df441a256663f218180d3b404c294cd7
MD5 5f900f25e4146947aa8efdf5452ee87c
SHA1 6d0e6f67b4f9813918d818322108436afe50382d
SHA512 688f26a073c50b8561f418c06e33ede059f566d619408512298c3af26a8b62e877fef2c172aff9bb9251d5fdf989a8b20918955205aa12f1bdafe74ebce17445
SSDEEP 192:sxZ1gXRWyM/jK1Ml8UQgg5/fEs+YIdpNxSHW6+WNnr96/YLuUBXIg5cJ:sxZ1gXUq15/fEs+pOHbQ/oS
TLSH
T19D52E811AA346977CCDBD20DB951BB53D6F9547292500E48AAFCDA1C00E7BEE2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7e6e965f998deb9b4c2ec576956bc98941059dc8a0ed38046e745c5eba80b61b
MD5 4b375c3443baa1b06afe01e9351426ce
SHA1 cd64cd750ca83b069a28fb2f64523c679847e05f
SHA512 6d8e50a0a80ef4bb62bd91a2e15c160cd076b5443b8ce59497d530da21684c7b484e5c3ff6aea41b68d6dd37b24dd5c38917b88788f21a41017af262254bbaf6
SSDEEP 192:sxZ1gXRWyM/jK1Ml8Mg5/fEs+YIdpnxSHW6+WNnr96/YLVbZXIg5cJ:sxZ1gXU45/fEs+pEHbQ/MS
TLSH
T11D52E911AA346977CCDBD209B955BF53D6F9547392900E489AFCDA1C00E6BEE2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 eb54cf05f16836e01bb8e80f25e3dc7affdc90efb73ea1f0653356af4e5b54cf
MD5 850f675eef977b8071fe6ff54f8239c8
SHA1 83dd2fe20a3a4c57db47aa9ba37f179bdc4b27e8
SHA512 68be95accccef4abf7c7550c3112203d17b6e03b9e7c209fe905ae14aa1c8964fbdeda71c2ca18e07ea2ce7f9d8f7a8beb72832bcb60eddf301a795a5fc0f7d3
SSDEEP 768:4ys6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNrroaG:4ys6pD1WvxzWju1jahILIsNYaG
TLSH
T13AD2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 c5548cadba6bb72f2dea8aa4955bda190c1397faca9c9ba76997b10ad6ee0799
MD5 a08101db9f002d68e89a38cac6975760
SHA1 5793bc39be8adf48f82f799a99c29b82064b6da3
SHA512 7d156fb86ee94c38133a485161931ddefad048f8faf28349965c6e561c1ff9557c6815b9e4c570d3d2f3648850ffdcb5f8aa285d76150f8199e191bab21acca8
SSDEEP 96:KUAAKtePevCKoUOKhCKqkRgIKZumioQKV+5:iihpFpPza
TLSH
T1EFE1D12276B703513C7D2B0892D5C7278A43B563741DA92B3BEE40B58DA6E208DBCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

114041b9-f51c-4ed1-8b21-ea6b65538824.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\114041b9-f51c-4ed1-8b21-ea6b65538824.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ca6ba3d8ef04cf5ac57cd50c0a5f8a1aec833f848d799dbe187daede071994aa
MD5 18ac7908f4159d64e033a207707323d9
SHA1 71a341d2cde35ee1aa805ce74b1faa4791c0abcd
SHA512 2ab024835c86e02a65d850ed1551902194536fdeabe6d2f85c448aa222c80a1a2b2f47ffeb3762cc7824ae51fb977045fd4871d92f7fa13da9b703233a440151
SSDEEP 384:4ZcIVsNMXG7OvWa9HON8P+NQ7O6R2Feoffoo:GVZX9ON8PKQ7TR2fv
TLSH
T14E826B3168789D7669F7D145F98736078FB8C067968A5E80D5ECBF1D00DBAB8230AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7e2b53677a6edc46bae356ed3756ef01557cea4a9e2988daec83a204b274be20
MD5 23a6ce097b196f04371c753a2c863bf2
SHA1 7a927d641c221b558808fc3d6b7a6d4a5d812992
SHA512 5e4cd93e71eb12d5edfc4ce14fd1428c64398c3bb5a30963141fd43845de41593c939b6afd45d0b07bf97b4dcf0d738c6731bb175f97b85593e2dee2d10fba0d
SSDEEP 384:xZcIusNMYG7oMWa9HON8P+eQ7O6R2Feoffoo:ZuTX9ON8PxQ7TR2fv
TLSH
T151827C3168789D6669F7E145F94736079FB8C063968A5F80D5ECBF1D00DBAA8230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9b44a3019a7c58f763b4f6933550091e514ddce24578c8e1bde41799f2a09228
MD5 b9d5df0bc3a9de05a2f09853823c1aa6
SHA1 20d386f786719cd060538cd6c6ba138920e7a965
SHA512 7c1afeb8f7366f5acd889403fcfcf41af6189172466fdd3f4f68b74c9ef0ffeebeb3d08c0cbfbb556ee04471251911b24aca42f84cc825afd43078b3712990af
SSDEEP 192:qONF6O7+3hQmiUyrdGttb0qO2bo81gGvSU6:qONF612Gt9HON8FqU6
TLSH
T1C302EA356C686C775EF3AE45B98727179FA8103BE9962F40D6E85F0C00D765C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 f417d1a22c588500c99533e9735d707d9cf55468651552ce1d0e0ddf662bb355
MD5 7b7e5eeb1d35080a42df3b43f2c6e792
SHA1 b62d5556921273506ecd4f06471315c04bcf9c43
SHA512 3215533397a1a7f3c3135cc4232f3ff592b1fbbbbfed622eb093abed608ddb491a9b5226dc49cc9f19db488be9b01b69ed1d45da042d9564b5dba440da576928
SSDEEP 384:wiFsZcIrsNE8TUNTUlIlYG7oTWa9HON8P+/Q7O6R2Feoffoo:LF6rJwgeX9ON8PyQ7TR2fv
TLSH
T19AA26C325868CD7AADF79645FA4A3207CFB980A7C5869A90D6DCAF1D00DB5EC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3f480d0ba43cf0c921770e554b32418574134b1014900a30dd149f114166eab6
MD5 59c96aa508539dd9d4e46b6dbeacf78f
SHA1 36a3127a1878ede151d19f575d478e2b5705587c
SHA512 de9ca6162d1b609cba897bebb72ffef70dafd8eff5341dae184c91726b30d9828bf59ec91ab9838bbbf9696a8f8b2f36e172f895e5b09e2ac8d388541ec3bc64
SSDEEP 384:+ZcI6sNMYG7oTWa9HON8P+eQ7O6R2Feoffoo:86MX9ON8PxQ7TR2fv
TLSH
T1B0827B3168789D6669F7E145FA4736078FB8C067968A5E80D5ECBF1D00DBAA8230AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2fbd63d67e106f2828df7823c1cbebf58683da7f3800b054a6a93f0c4ca9aadb
MD5 c3ad54adfeefa1598ebb910e4047367e
SHA1 dbe41f7abe01bcfca17e02adc54881dd3cdc298c
SHA512 9009e1338eaa2a9fcf4e3b74c8a7053009d737831f5088ef19f303086fcc39a4e586cbe51269a30bff80ba83071e100dc06379b46e48fdf762eadd35e607d3ab
SSDEEP 192:HONV6O7+3TQmiUyvdCttb0qO2bo8P+TcNEqAfU6:HONV6vACt9HON8P+oQU6
TLSH
T1C91219357868AC675EF3A145F98731178FA94137EA466F80D5DC6F0C01EF6AC234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba3f93af-7cbb-40b8-be7a-e189647e95ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ba3f93af-7cbb-40b8-be7a-e189647e95ff.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 77c1100a65a17509677b60a10f7480aa7bc8a3a0f385d27b02af833dd48f944a
MD5 2519d4bcdffc971591311e9c8731b2cb
SHA1 bde6884da15157b1543cb2f5fd3581d77acf44a5
SHA512 1f58e6045e8f63865c91f6ee0ee24e2a6ccb6d1cc9b77420822fa3bfae114a433b40f8382b2c18ab2dd09858e4f8d590294714c98875cc37a1deb04d5433cba5
TLSH
T18A413958BAEA1158B3737E565FF6A96E487EB9772F06D45E00010E4F0A33B40C9A2733
MD5 SHA1 SHA512 TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 4add7929c8b10034b5498342644651feda88feba45eac0d6844a01f5c2fc61bd
MD5 faf750cebe621de618e6c5e6b8fee065
SHA1 7f04b75f9bcff9aaf4fda9aed4c27cbc05995e11
SHA512 74c503dec3cff5b339bb7583b5e6e1535e56e54e1694d523fa69566220c79f1c110d7045af8e14752698910f7d433290fdae05e9940c300ec307b6d0206b3b85
SSDEEP 384:HkCjiO024YUDL84KKDL849B7SOEAd9KVRaAcP+AWRMAhtD:EzZYUDL8lKDL8CB7S/AmVAf+hRMa
TLSH
T1D7729E395F003CBC1597C0E8C5F9929A8D18B7A7DFE680AD21583D0DCAD8A69B4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iorza73p.default-release\prefs-1.js
Size 7KB
SHA256 5b45bdf20ded329ccf875e1856bed971371bb106b677f9aadbbfc1c6613b1456
MD5 7313166d707692b30c6f6de9f287705f
SHA1 240686c1f302970c624a4189324ad4ffe21da700
SHA512 182680b4db5bd0337efdf73ac0281ffbabad05896e899621525109ce0769f0fff54e771df45e0a248f4197ac529e9dd6007a271a3743234e99c6efaccfd1a22d
SSDEEP 96:xHi4TUMqGq/fsrO1zSQSSlmdv9jtnytHlAsO7HjvsBw88n4qR8L4cn23U1K:UDR/fsrOVSSnxisIHzsBw88bD
TLSH
T15DF110389444CB7F64B636BCAC24497169B2013BB7BF68D310B954C5055CF3451FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download